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REMARKS 

The present application was filed on October 12, 2001 with claims 1-27. Claims 1, 14 and 
27 are the independent claims. 

In the final Office Action, the Examiner: (i) maintains the rejection of claims 1,3,14, 16 and 
27 under 35 U.S.C. § 1 03(a) as being unpatentable over D. Mishra, "SNOOP: An Event Specification 
Language for Active Database System," Thesis from University of Florida, 1991 (hereinafter 
"Mishra") in view of U.S. Patent No. 6,006,213 to Yoshida (hereinafter "Yoshida"); (ii) maintains 
the rejection of claims 2 and 15 under 35 U.S.C. § 103(a) as being unpatentable over Mishra in view 
of Yoshida in further view of U.S. Patent No. 5,345,380 to Babson et al. (hereinafter "Babson"); (iii) 
maintains the rejection of claims 4-7, 11, 13, 17-20, 24 and 26 under 35 U.S.C. §103(a) as being 
unpatentable over Mishra in view of Yoshida in further view of U.S. Patent No. 6,249,755 to Yemini 
et al. (hereinafter "Yemini"); (iv) maintains the rejection of claims 8-10, 12, 21-23 and 25 under 35 
U.S.C. § 103(a) as being unpatentable over Mishra in view of Yoshida in view of Yemini in further 
view of Bettini et al, "Testing Complex Temporal Relationship Involving Multiple Granularities 
and Its Application to Data Mining," ACM 1996 (hereinafter "Bettini"); and (v) rejects claims 28 
and 29 under 35 U.S.C. § 103(a) as being unpatentable over Mishra in view of U.S. Patent No. 
6,108,698 to Tenev (hereinafter "Tenev"). 

In this response, Applicants traverse the various § 1 03(a) rejections for at least the following 
reasons. 

Regarding the § 1 03 rejection of claims 1,14 and 27, Applicants again respectfully assert that 
the Mishra/Yoshida combination fails to teach or suggest each and every limitation of the claimed 
invention. 

For example, as recited in amended independent claim 1, a computer-based method for use 
in accordance with an event management system comprising the steps of automatically generating 
one or more event relationship networks from event data, wherein an event relationship network 
comprises a graphical representation wherein nodes represent events and links connect correlated 
nodes, and utilizing the one or more generated event relationship networks to construct one or more 
correlation rules for use by a correlation engine in the event management system. Independent 
claims 14 and 27 recite similar limitations. 
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The present specification explains, by way of example at page 7, line 6- 1 0, that the approach 
taken by the present invention is to describe correlation logic uses a conceptual framework called 
event relationship networks or ERNs. In one embodiment, an ERN is a directed cyclic graph. 
Nodes are events and are labeled with the role of the event within the case. Arcs or links from one 
event to the next indicate that the latter is associated with or correlated with the former. 
Furthermore, as the Abstract of the present application states, in conventional approaches, ERNs are 
constructed purely based on human expertise and there is no automatic or event semi-automatic 
method that validates or completes ERNs. The present invention provides techniques for 
automatically validating and completing existing ERNs and/or constructing new ERNs, based on 
collected event data. 

The Mishra/Yoshida combination does not disclose automatically generating one or more 
event relationship networks from event data, wherein an event relationship network comprises a 
graphical representation wherein nodes represent events and links connect correlated nodes, as in 
the claimed invention. 

The final Office Action cites the "event compiler" and "event graph" on pages 57 and 58 of 
Mishra in support of rejecting the claimed step of automatically generating one or more event 
relationship networks from event data, wherein an event relationship network comprises a graphical 
representation wherein nodes represent events and links connect correlated nodes. However, the 
event graph of Mishra is not an event relationship network that can be used to construct one or more 
correlation rules for use by a correlation engine in an event management system, as in the claimed 
invention. In fact, as explained at page 57 of Mishra, a rule is actually the input for the graph 
building algorithm. Then, as explained at page 58, in the event detection technique of Mishra, it is 
assumed that a event graph already exits and Mishra is detecting instances of the event graph. Thus, 
this is significantly different than what is claimed. 

The Examiner explains in the "Response to Arguments" section of the final Office Action 
(page 2) that Mishra teaches taking an original rule and creating a "Rule-b" using a constructed tree. 
Even if this were accurate (which Applicants assert is not the case), such a process does not disclose 
the steps of the claimed invention. Again, the claimed invention generates one or more event 
relationship networks from event data . and utilizes the one or more generated event relationship 
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networks to construct one or more correlation rules . By any interpretation of Mishra, this is not 
what the "event compiler" and "event graph" of Mishra do. 

For at least the above reasons, independent claims 1, 14 and 27 are patentable over the 
Mishra/Yoshida combination. Further, dependent claims 2-13 and 15-26 are also patentable over 
the Mishra/Y oshida combination and the further combinations with Yemini, Babson and/or Bettini 
not only for the above reasons, but also because such claims recite patentable subject matter in their 
own right. Yoshida, Yemini, Babson and Bettini do not remedy the above-described deficiencies. 

Applicants added, in their previous response, new claim 28 which recites that the automated 
generation of at least one of the one or more event relationship networks comprises use of an 
automated pairwise statistical correlation procedure which is configured to compute a first 
correlation metric and a second correlation metric, the second correlation metric being representative 
of a correlation between events that is stronger than a correlation between events represented by the 
first correlation metric. Support for this feature may be found throughout the present specification, 
by way of example, see page 7, lines 1-3, as well as the further descriptions of the "weak 
correlation" metric and the "strong correlation" metric in the detailed description. 

Further, new claim 29 was also added and recites that the automated generation of at least 
one of the one or more event relationship networks comprises specifying an event data window 
within which event data is considered. Support for this feature may be found throughout the present 
specification, by way of example, see page 14, lines 5 and 6, as well as the further descriptions of 
the "window length w" in the detailed description. 

In the final Office Action, the Examiner has introduced the Tenev reference in combination 
with Mishra to reject new claims 28 and 29. In particular, the final Office Action points to column 
9, lines 32-45, of Tenev to reject claim 28 and column 13, lines 28-39, of Tenev to reject claim 29. 

Column 9, lines 32-45, of Tenev read: 

FIG. 6 illustrates features of directed graph data structure 330 that are relevant to the 
operations performed by grapher routines 320 in relation to the expansion flags. 

Identifier (ID) mapping structure 350 maps from element IDs to pointers. The element IDs 
include node IDs and link IDs. Structure 350 makes it possible for every node and link in memory 
to be specified by an ID which can be validated in constant time and nearly always created in 
constant time; structure 350 avoids the need to use pointers except within directed graph data 
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structure 330. Although implemented as two arrays of pointers, one indexed by the node IDs and 
the other by link IDs, structure 350 could also be, for example, a lookup table in which each entry 
includes an ID and a pointer. 

No where does this portion of Tenev or any other portion of Tenev teach or suggest 
computing a first correlation metric and a second correlation metric, the second correlation metric 
being representative of a correlation between events that is stronger than a correlation between 
events represented by the first correlation metric, as in claim 28. In fact, Applicants fail to see any 
discussion whatsoever in Tenev regarding such correlation metrics. 

Further, column 13, lines 28-39, of Tenev read: 

FIG. 9 shows a sequence of representations of the graph shown in box 202 in FIG. 4 that 
could be presented as a result of operations like those described above in relation to FIG. 7, without 
creating or removing any nodes. Each representation could result from a respective iteration in FIG. 
7, either an iteration through boxes 364 through 382 in response to an expand signal or an iteration 
through boxes 390 and 392 in response to a contract signal. In each representation, a node feature 
with a "+" indicates that the represented node is contracted in the tree, while a node feature with a 
"-" indicates that the represented node is expanded in the tree. 

No where does this portion of Tenev or any other portion of Tenev teach or suggest 
specifying an event data window within which event data is considered, as in claim 29. The "+" and 
"-" mentioned above in Tenev relate to the graph itself and not to any event data or an event data 
window within which event data is considered, as claimed. 

In view of the above, Applicants believe that claims 1-29 are in condition for allowance, and 
respectfully request withdrawal of the § 103(a) rejections. 



Respectfully submitted, 



Date: August 31, 2006 




Attorney for Applicant(s) -/ 
Reg. No. 39,274 
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